PDF malware analysis — malicious · 2db3ce97cc2391cd

MALICIOUS

PDF

63.4 KB Created: 2020-12-28 05:35:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05

MD5: 0a277bcd39dedafe587e21e23033d108 SHA-1: 6df36aa503a77d969a0a6de7c6fc9d8c541c072a SHA-256: 2db3ce97cc2391cde18f50b13988cf62ae20552c65aa8c9b5e18ee3a9224f047

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/strik?utm_term=master+sword+wallpaper+iphone PDF link annotation
- https://static.s123-cdn-static.com/uploads/4494883/normal_5fe0763460011.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4428341/normal_5fa7e87434330.pdfIn PDF document text
- https://cdn.sqhk.co/minamojazi/TNMhX3Z/niranuluwozosalepo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393641/normal_5fd651ea4a53e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4458124/normal_5fe3efc331980.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4455194/normal_5fb3d0e859bd5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4409627/normal_5fbe27c984f29.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4386333/normal_5f94bcde91831.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/c7779f05-f6db-47b8-b6db-1dbfd151a241/lab_sergio_franco_piratininga.pdfIn PDF document text
- https://s3.amazonaws.com/lewuli/australian_blueprint_for_career_development_worksheets.pdfIn PDF document text
- https://s3.amazonaws.com/sukedil/the_demi-gods_and_semi-devils_tv_show_cast.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aea493a2-305c-4868-a1f5-d5c5e75a33f2/54174489990.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bca9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBCA9	5144 bytes
SHA-256: `5b77770c65a0036bb4c25b83efeec1bd6d88051c49e0cac6e1fc52d95d4907d1`
`font_01_sfnt_off0000ce3c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCE3C	10216 bytes
SHA-256: `5c162de59945a58dd41c97720a289b47af0a31bd2e0e70eddb6ebd9b422e7adf`

Open this report in the interactive analyzer, or submit your own file for analysis.